Attack of the Clone(d) Data

Pillar 02 · Legal

Same country. Same laws. Same court order. Two very different mornings.

Morning one

A CIO at an Ontario health network gets an email at 6:42 a.m. from her cloud provider's legal notification service. She didn't know that service existed. A production order has been served, not on her hospital but on the provider's US parent.

(She's fictional, by the way. The legal mechanics are not.)

Her counsel walks her through it. Under the CLOUD Act, a US-domiciled provider can be compelled to produce any data in its possession, custody or control, and it makes no difference where the bytes physically sit. Her patient records are in the Toronto region. Canadian soil, Canadian data centre, maple leaf on the marketing page. Doesn't matter. The provider holds the keys, so the provider can be compelled, and depending on the order it may be gagged from telling her what was produced.

"We have data residency guarantees in the contract."

"You have a promise. This is a statute. Statutes beat promises."

It gets worse from there. Her team prices out repatriating the data to infrastructure the hospital actually controls, and egress fees alone run six figures. The data went in free. It comes out at a toll. Nobody put the toll in the business case because the toll is the business model.

Her privacy officer piles on: the adequacy frameworks everyone leaned on are shaky, and every workload sitting on US-controlled infrastructure is exposure. Meanwhile our own Parliament is moving lawful-access legislation, so before long her provider answers to two governments with legal levers into the same infrastructure, each with its own gag provisions. She won't know which one turned the key.

At 4 p.m. she briefs the board. There is one slide she can't make honest. It's titled "Who can read our data without our knowledge?" and the truthful answer is a list of parties she can't name, acting under processes she'll never see.

She hosted her data in Canada. She never held it.

Morning two

Same CIO, same order. The law didn't change between these two stories. The CLOUD Act is still on the books and Parliament is still legislating.

What changed is what the order can reach.

The order lands on one of the infrastructure providers in her custody chain, and the provider's answer isn't refusal. It's incapacity.

Every object was encrypted on the client side before it left the hospital, so no custodian ever held a usable key. The ciphertext was then erasure-coded and spread across independent custodians in separate legal jurisdictions, and below the reconstruction threshold the fragments are useless. The provider served this morning holds one fragment and no keys. What it can lawfully produce is noise.

To compel the actual record, an authority needs valid process against a threshold of custodians in multiple jurisdictions at the same time, plus key material only the data owner controls. Good luck.

Contractual sovereignty asks the provider to promise. Architectural sovereignty removes the provider's ability to comply.

And she gets something morning one never had: knowledge. Every custody event, whether a read, a write, a reconstruction or a key operation, lands in a tamper-evident signed ledger. In morning one, disclosure happens in the dark under someone else's gag order. In morning two, nobody touches the data without leaving cryptographic evidence, and the evidence is unreadable without her keys anyway.

Board slide, 4 p.m. "Who can read our data without our knowledge?" Nobody. Not because everyone promised. Because nobody can.

The point

A production order doesn't take your data. It clones it. A copy walks out the door and you're not on the distribution list. The only real defence is making sure every clone is noise.

Residency tells you where the bytes sleep. Sovereignty tells you who can wake them. Only one of those survives contact with a court order, and it's the one written in cryptography and jurisdiction rather than Schedule B of your hosting contract.

Which morning are you living in?

Bias declaration: I build this. SkyeConnex is architectural sovereignty for data. Zero-knowledge keys, erasure-coded custody across jurisdictions.